From owner-svn-src-head@freebsd.org Wed Jan 24 05:09:22 2018 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9C7EDEBE182; Wed, 24 Jan 2018 05:09:22 +0000 (UTC) (envelope-from np@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4DCE177D46; Wed, 24 Jan 2018 05:09:22 +0000 (UTC) (envelope-from np@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4473C19348; Wed, 24 Jan 2018 05:09:22 +0000 (UTC) (envelope-from np@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w0O59MvI079012; Wed, 24 Jan 2018 05:09:22 GMT (envelope-from np@FreeBSD.org) Received: (from np@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w0O59MXg079010; Wed, 24 Jan 2018 05:09:22 GMT (envelope-from np@FreeBSD.org) Message-Id: <201801240509.w0O59MXg079010@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: np set sender to np@FreeBSD.org using -f From: Navdeep Parhar Date: Wed, 24 Jan 2018 05:09:22 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r328314 - in head/sys: netinet netinet6 X-SVN-Group: head X-SVN-Commit-Author: np X-SVN-Commit-Paths: in head/sys: netinet netinet6 X-SVN-Commit-Revision: 328314 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jan 2018 05:09:22 -0000 Author: np Date: Wed Jan 24 05:09:21 2018 New Revision: 328314 URL: https://svnweb.freebsd.org/changeset/base/328314 Log: Do not generate illegal mbuf chains during IP fragment reassembly. Only the first mbuf of the reassembled datagram should have a pkthdr. This was discovered with cxgbe(4) + IPSEC + ping with payload more than interface MTU. cxgbe can generate !M_WRITEABLE mbufs and this results in m_unshare being called on the reassembled datagram, and it complains: panic: m_unshare: m0 0xfffff80020f82600, m 0xfffff8005d054100 has M_PKTHDR PR: 224922 Reviewed by: ae@ MFC after: 1 week Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D14009 Modified: head/sys/netinet/ip_reass.c head/sys/netinet6/frag6.c Modified: head/sys/netinet/ip_reass.c ============================================================================== --- head/sys/netinet/ip_reass.c Wed Jan 24 04:29:16 2018 (r328313) +++ head/sys/netinet/ip_reass.c Wed Jan 24 05:09:21 2018 (r328314) @@ -377,6 +377,7 @@ ip_reass(struct mbuf *m) q->m_nextpkt = NULL; m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags; m->m_pkthdr.csum_data += q->m_pkthdr.csum_data; + m_demote_pkthdr(q); m_cat(m, q); } /* Modified: head/sys/netinet6/frag6.c ============================================================================== --- head/sys/netinet6/frag6.c Wed Jan 24 04:29:16 2018 (r328313) +++ head/sys/netinet6/frag6.c Wed Jan 24 05:09:21 2018 (r328314) @@ -541,6 +541,7 @@ insert: while (t->m_next) t = t->m_next; m_adj(IP6_REASS_MBUF(af6), af6->ip6af_offset); + m_demote_pkthdr(IP6_REASS_MBUF(af6)); m_cat(t, IP6_REASS_MBUF(af6)); free(af6, M_FTABLE); af6 = af6dwn;